Security

Architecture

• Image conversion runs locally in the browser; image data is never transmitted.
• There is no image storage bucket, so there is no image data to breach.
• No server-side fallback conversion exists.

Transport and headers

• HTTPS everywhere, with HSTS.
• A Content Security Policy that avoids unsafe-eval; the decoder is CSP-compatible.
• X-Content-Type-Options, Referrer-Policy and frame-ancestors restrictions.
• Permissions-Policy disabling camera, microphone and geolocation — the converter needs none of them.

Data and access

• Row Level Security on customer tables, default deny, scoped to the signed-in user.
• Administrative roles stored in a dedicated table and verified server-side only.
• Service-role and Stripe secret keys held server-side and never shipped to the browser.
• Administrative actions written to an audit log.
• Administrators cannot view customer photos; no image gallery exists anywhere in the product.

Billing

• Card data is entered only on Stripe-hosted pages.
• Stripe webhooks are signature-verified and processed idempotently.
• Paid access is granted only from verified server-side subscription state.

Operations

• Rate limiting on registration, password reset, support, privacy requests and billing endpoints.
• Dependency updates and automated dependency scanning.
• Secure password reset with generic responses to reduce account enumeration.

What we do not claim

We do not claim SOC 2, ISO 27001 or HIPAA compliance, and we do not use marketing phrases such as "military grade". No third-party security audit has been performed.

Reporting a vulnerability

Email info@heicconvertfree.com with details. Please do not test against other users' accounts.